{"id":"CVE-2026-111574","revision":"509dff88925749cfb1fa9af861e02a56","records":[{"revision":"509dff88925749cfb1fa9af861e02a56","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-111574","aliases":[],"title":"Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox","description":"The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.","state":0,"publishedAt":"2026-10-21T06:00:22.249+00:00","modifiedAt":"2026-10-21T10:35:03.878+00:00","affected":[{"ecosystem":"Vendor product","name":"Redirection for Contact Form 7","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Redirection for Contact Form 7\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"2.2.7\",\n                            \"lessThan\": \"3.2.12\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/f40440de-3947-48f9-8fa4-200f83e87d8e/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111574","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111574","identifiers":["CVE-2026-111574"]},"retained":false,"historicalAffected":[]}],"coverage":[]}